Questions tagged [tunnel]

For questions about network tunnels.

Filter by
Sorted by
Tagged with
18
votes
4answers
1k views

Is GRE necessary for an IP-only tunnel?

I need to build a simple point-to-point tunnel to connect an office through an area of the network we trust but directly don't control. Does the tunnel need to be GRE-encapsulated or can I use direct ...
14
votes
3answers
16k views

how to block ssh tunneling traffic?

if someone were to set up an ssh tunnel to/from work or home, is there a way to prevent future SSH tunneling traffic? I understand that websense can block traffic, but users who use ssh tunneling can ...
12
votes
2answers
11k views

VXLAN vs VLAN over layer 3

I read that one of the benefits of VXLAN over VLAN is that it can spawn across WAN and multiple layer 3 networks by creating overlay layer 2 networks. However AFAIN VLAN can also do the same using ...
9
votes
3answers
11k views

What is the use of a tunnel interface on a cisco router?

What is a tunnel interface used for on a cisco router? What is the difference between setting up a VPN connection and a tunnel interface; or does this serve the same purpose?
7
votes
3answers
3k views

Is the Nth ports on 127.0.0.1 and 127.0.0.2 same ?

I want to create ssh tunnels between 2 clients and 1 server. Can I use the same port numbers for both but binding one of them to 127.0.0.1:N and the other to 127.0.0.2:N ? Are these ports same or can ...
6
votes
2answers
1k views

Encapsulation: can a higher protocol encapsulate a lower protocol?

I've heard someone say that a protocol higher up the osi model can encapsulate a lower protocol. As far as I know, personally, a protocol can only encapsulate a same-level protocol or one at a ...
6
votes
2answers
349 views

What are the correct protocol versions (v4 vs v6) for packets inside DS-Lite tunnels?

I work for a company that develops Deep Packet Inspection tools. One of our customers, big ISP who has a large number of DS-Lite connected subscribers, was using our DPI engine to collect statistics ...
6
votes
4answers
18k views

Tunnel interface bandwidth?

I am a little confused with the bandwidth setting on Tunnel interfaces between two Cisco devices. On each end I have Cisco routers with ten gig interfaces connected to my provider. I Have a tunnel ...
5
votes
2answers
2k views

HSRP + OSPF over tunnel interface

We have 3 sites over an MPLS. Each site has 2 x Cisco 2911's running HSRP. Each site has a tunnel interface from it's local site to the remote site over the MPLS. The tunnel interfaces are mirrored on ...
5
votes
3answers
16k views

Stuck at GRE troubleshooting with recursive route

As with my last question, I am learning for my CCNA exam and currently I am bashing my head against the wall, while trying to solve "7.2.2.4 Troubleshooting GRE" I'll explain the topology in a second....
5
votes
3answers
418 views

Why do all the intermediary routers need to run iBGP without tunneling?

I'm trying to understand the configuration behind iBGP - I understand you can run full mesh to prevent loops, run confederation or route reflectors, if you don't want full mesh, else run tunneling ...
5
votes
3answers
3k views

Network Tunneling - why do we need it?

I have researched the topic of Network Tunnel but the information on this is rather confusing and inconsistent. So could someone please explain: In general, What is tunneling? Is it simply an act of ...
5
votes
3answers
3k views

Cisco QinQ - More than one provider vlan (s-vlan) on dot1q-tunnel port

When we configure a qinq tunneling, the port, which performs the encapsulation, has the next command-lines: interface g0/10 switchport switchport mode dot1q-tunnel switchport access vlan xxx &...
5
votes
2answers
15k views

Openswan Site-to-site VPN -- cannot respond to IPsec SA request because no connection is known

I am setting up a ISPEC tunnel between a Linux System running Openswan and a Cisco ASA 5505. The strange thing is, the tunnel comes up I believe (based on the screenshots below), but I can't get ...
4
votes
4answers
666 views

Tunneling query

I'm researching various tunneling technologies and I have a fairly good understanding covering some of the basics. In a site-to-site VPN the edge routers could appear as only one hop away. I've also ...
4
votes
2answers
437 views

MTU/MSS Oddness?

We have an IKEv2 IPSec tunnel between two Sophos XG Firewall appliances in a corporate system for a remote site. We don't have any specialized MSS or MTU settings other than what the IPSec tunnel ...
4
votes
4answers
1k views

Encrypting All Network Traffic

For a corporate network, is there a way to possibly encrypt all network traffic on the local network? I would like to ensure that there is nothing left for chance to be packet sniffed. Not even e-...
4
votes
1answer
667 views

How IPsec tunnel mode work without GRE

IPsec tunnel mode encrypt a whole IP packet and sends it as the payload of another IP packet. I have always used GRE as the encapsulation layer when doing IPsec encryption. However, how could I have ...
4
votes
1answer
282 views

Cisco IOS -> ASA VTI tunnel not routing traffic

I have a VTI tunnel configured between two devices (ASR and ASAv). The tunnel comes up fine and is stable, however traffic appears to be unidirectional, from the ASR -> ASAv but not in the reverse ...
4
votes
1answer
623 views

Scaling VXLAN tunnels in openvswitch

As we're creating a cluster of tens of KVM host nodes we've chosen openvswitch as our virtual network infrastructure. So we need to make isolated virtual networks between VMs on demand. I've seen ...
4
votes
1answer
9k views

ASA VPN works as responder but not as initiator

I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.) When the pfSense starts the connection, everything works fine. When the ...
4
votes
1answer
21k views

Sonicwall not fowarding VPN traffic over tunnel

My office network is 10.25.0.0/16. I have a VPC in Amazon that's 10.100.0.0/16, and I have a VPN established between the office and the VPC using Amazon's Virtual Private gateway. This connection ...
4
votes
1answer
279 views

Identifying teredo packets and teredo relay port

I'm trying to identify teredo packets on a network, and I'm getting conflicting information on whether or not the Teredo relay machine, which sends the actual ipv6 encapsulated traffic, listens on ...
4
votes
1answer
845 views

ASA 5505 Post-Upgrade One-Way Traffic Flow

I’m hopeful that someone can give us a pointer as we are sure it is a very simple error. We were recently running an IPSec site-to-site VPN using 2 x Cisco ASA 5505s between a UK and US office. Both ...
4
votes
0answers
456 views

Dual-Hub DMVPN Outage

Our backup links have always utilized a GRE tunnel based VPN to a hub. Recently we installed a second hub and migrated the primary links to GRE tunnel based VPN with EIGRP to handle routing between ...
3
votes
2answers
655 views

How to solve this IPv6 looping problem?

I have set up a 6in4 tunnel, namely "sit1", but I have discovered that if I traceroute non exist IP within the subnet, it will loop. What should I do to solve this? The routing table:
3
votes
2answers
721 views

OSPF on tunnel interfaces

Can I keep different tunnel interfaces in different OSPF areas. Keep in mind that the physical interface is going to be the same
3
votes
1answer
1k views

Could accessed sites over an SSH tunnel be tracked by ISP? [closed]

I created an SSH tunnel and using it as SOCKSv5 proxy on Firefox. I checked whatismyipaddress.com and some other sites, they could not detect a proxy on my computer and shows my location on the server'...
3
votes
2answers
36k views

Windows - ping an ip via different interfaces

I am working on Windows Server 2008/12. I have two interfaces: a PPTP tunnel and the LAN card and I want to ping an IP via both of them to compare their results. As per the documentation, that should ...
3
votes
2answers
439 views

IPsec VPN Tunnel Through an Uncontrolled Network

I'm trying to figure out how to setup multiple IPsec VPN tunnels, and before I spend any money on hardware, I want to make sure I'm understanding this correctly. My plan is to setup a Vyatta Core ...
3
votes
2answers
312 views

IPv6 tunneling over IPv4

I am willing to build a program that simulates the routing process of IPv6 packets over an IPv4 overlay network (tunnel). From what I have read so far I have understood that the IPv4 tunnel packets ...
3
votes
2answers
953 views

What problem does GRE solve?

As per the RFC, GRE (Generic Routing Encapsulation) specifies a protocol for encapsulation of an arbitrary protocol over another arbitrary network layer protocol. I don't think I understand why GRE ...
3
votes
3answers
580 views

Layer 3 tunnel with Dynamic IP address

I want to ask whether it is possible to configure Layer 3 Tunnel with the two end points/interfaces have dynamic IP address? If the interface IP change, the tunnel will have to be re-negotiated, is ...
3
votes
1answer
2k views

Obtaining MAC address of an external IP

Is there any way to resolve an external IP address to a MAC address without access to the specific LAN? In other words, is it possible to obtain a MAC address for any given public IP? To my ...
3
votes
1answer
15k views

ASA tunnel up but not passing traffic

I have two offices (Victoria at IP 1.2.3.4 and Toronto at IP 5.6.7.8) each with pfSense running Strongswan, and each with an IKEv2 IPSec tunnel back to a Cisco ASA 5512 at IP 9.8.7.6. I recently ...
3
votes
2answers
6k views

Route-based ipsec between cisco router end juniper srx

network experts! Help, please, to understand why there is no ping from source address to destination address over ipsec vpn(here, route-based). I have such schema: Phase1 and Phase2 of IPSec are up....
3
votes
1answer
655 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
3
votes
1answer
103 views

How to connect servers from different Datacentres via firewall

really need help since I am still new in firewall. I have 2 firewall located in two separate Datacentres. I need to make a connection for the servers from these 2 DCs. One firewall is running pfsense ...
3
votes
2answers
583 views

Site-to-Site VPN tunnel configuration

I remember in uni that we implemented VPN tunnels always on the border routers and then use GRE tunnels to connect between two remote subnets. I was always told that VPN tunnels need to know the ...
3
votes
1answer
5k views

What is the difference between ip nhrp nhs and ip nhrp map?

These two commands seems similar when I configure a DMVPN Spoke. What is the difference? interface Tunnel1 ip address 192.168.88.2 255.255.255.248 no ip redirects **ip nhrp map 192.168.88.1 10.0.1....
3
votes
0answers
200 views

IPSec Tunnel not coming up: Issue with ACL?

I'm trying to bring up a IPsec tunnel between router and a bridge. I can see the Ipsec tunnel configurations are up and running but I think I have made a mistake in the ACL and hence the encr and decr ...
3
votes
1answer
2k views

Site-to-Site IPsec VPN Tunnel - Certain Traffic Doesn't Work [closed]

I've been having some strange issues with some site-to-site IPsec tunnels using ESP and pre-shared keys that I've been working on for the past two weeks with no success. The tunnel has no problem ...
2
votes
2answers
802 views

What are the differences between tunneling and regular encapsulation?

What are the difference between tunneling (https://en.wikipedia.org/wiki/Tunneling_protocol) and regular encapsulation (e.g. TCP/UDP over IP, HTTP/SSH over TCP)? Is TCP/UDP over IP considered ...
2
votes
2answers
374 views

In tunneling, how destination routers identify if a packet is encapsulated?

In tunneling, a packet gets encapsulated in the payload section of another packet. If the router at one end encapsulates the packet, then how the router at another end identifies whether the packet is ...
2
votes
2answers
12k views

VPNs are working in which layer of the OSI model? [closed]

As the following picture shows, it is possible to categorize VPNs in two general categories: Client-based VPNs Network-based VPNs When it is required to choose a VPN for implementation in a network, ...
2
votes
2answers
209 views

Site-to-Site VPN with Sophos XG using tunnel interface

So I have configured a Sophos XG site-to-site vpn according to this document: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/...
2
votes
1answer
1k views

What's the difference between L2TP and L2TPv3? [closed]

Is L2TPv3 an improvement of L2TP or a completely different technology? Other than "it scales better" and "the non-proprietary MPLS" I can't find much information about it that's ...
2
votes
1answer
7k views

Which VPN Types/Protocols inherently support Multicast Traffic?

At my work, we build mobile networks from scratch for customers regularly. (Mobile Networks: think battery powered LTE router with wifi.) Since we build from scratch we can be vendor agnostic and ...
2
votes
2answers
1k views

Packet flow in GRE Tunnel

In the below image what would be the ip address in the outer ip header when packet goes from R1 to R2. If the ip address in the outer header is 172.16.0.1 , how does it travels the internet as its not ...
2
votes
3answers
1k views

GRE Tunneling on Cisco IOS - Destination Address

What is the reason that you cannot set the tunnel's other side as destination address? Is this because it is virtual only? 192.168.1.0/30 is the subnet I'm using and this is my configuration: ...